CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Description
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-209 · CAPEC-588 · CAPEC-591 · CAPEC-592 · CAPEC-63 · CAPEC-85
CVEs mapped to this weakness (48,564)
page 1447 of 2,429| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-23416 | Med | 0.35 | 5.4 | 0.01 | Jul 28, 2021 | This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input. | ||
| CVE-2020-5004 | Med | 0.35 | 5.4 | 0.01 | Jul 28, 2021 | IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:… | ||
| CVE-2021-23414 | Med | 0.35 | 6.5 | 0.03 | Jul 28, 2021 | This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code. | ||
| CVE-2021-20562 | Med | 0.35 | 5.4 | 0.01 | Jul 27, 2021 | IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to… | ||
| CVE-2020-23238 | Med | 0.35 | 5.4 | 0.01 | Jul 26, 2021 | Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature. | ||
| CVE-2021-37393 | Med | 0.35 | 5.4 | 0.01 | Jul 26, 2021 | In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected… | ||
| CVE-2021-37392 | Med | 0.35 | 5.4 | 0.01 | Jul 26, 2021 | In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the… | ||
| CVE-2021-36563 | Med | 0.35 | 5.4 | 0.02 | Jul 26, 2021 | The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side… | ||
| CVE-2021-37534 | Med | 0.35 | 5.4 | 0.01 | Jul 26, 2021 | app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster. | ||
| CVE-2021-37449 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected). | ||
| CVE-2021-37448 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored). | ||
| CVE-2021-37470 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript. | ||
| CVE-2021-37467 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected). | ||
| CVE-2021-37466 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected). | ||
| CVE-2021-37465 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected). | ||
| CVE-2021-37464 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored). | ||
| CVE-2021-37463 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored). | ||
| CVE-2021-37462 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected). | ||
| CVE-2021-37461 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected). | ||
| CVE-2021-37460 | Med | 0.35 | 5.4 | 0.01 | Jul 25, 2021 | Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected). |
- risk 0.35cvss 5.4epss 0.01
This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
- risk 0.35cvss 5.4epss 0.01
IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:…
- risk 0.35cvss 6.5epss 0.03
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
- risk 0.35cvss 5.4epss 0.01
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to…
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.
- risk 0.35cvss 5.4epss 0.01
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected…
- risk 0.35cvss 5.4epss 0.01
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the…
- risk 0.35cvss 5.4epss 0.02
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side…
- risk 0.35cvss 5.4epss 0.01
app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).
- risk 0.35cvss 5.4epss 0.01
In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
- risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
- risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
- risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
- risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via Conference Description (stored).
- risk 0.35cvss 5.4epss 0.01
In NCH Quorum v2.03 and earlier, XSS exists via User Display Name (stored).
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).